AntiVirus options today

[gpuerrilla]

Whilst people are negative over Kaspersky, it was proven the contractor for the NSA caused the issue and the AV copied the file for analysis. Unfortunately the only people to come out poorer from this was Kaspersky, however as they have tried to be transparent and are under the spotlight, if anyone I would rather use them than the dodgy free alternatives that bombard you with ads and monitor your browsing habits.

If your a complete tin-foil hat kind of guy then just stick with defender or something like ClamWin.

 

[jpaul]

вы проповедуете преобразованному

 

[gpuerrilla]

To be fair if your relying on AV products whether or not your a preacher or transformed, educated users could do away with overheads produced by most of these malware products. The likelyhood for me anyway is the rogue USB stick the wife could plug into the machine is the serious vector so depending on your situation and household you may need one. As for which brand it is preference. With any consumer product you will get brand loyalty and those that are burned will scorn hatred - go figure.

 

[jpaul]

good point -
Don't use it, but, I wonder how facebook has been resilient as a (software) malware distribution mechanism - curated attachments and gif rogue code inclusion mastered ?

EDIT : so facebook had been impacted , and, surprisingly, ms defender would not help unless you use unless you use edge/ie browsers

The problem of cryptocurrency-mining malware embedded in online ads reared its ugly head in a big way last week, as several malicious ads popped up on YouTube. This happened due to a rogue actor injecting corrupted content into Google's own DoubleClick ad network.
....
Most good antivirus software will screen the URLs your web browsers connect to. Microsoft's built-in Windows Defender does this as well, but only for Internet Explorer and Edge. To get similar protection for Google Chrome, Mozilla Firefox or Apple Safari, you'll need to use a third-party product. Alternatively, you could switch to Opera, a free browser that has an ad blocker built in

AV comparitives are a great site for reviews etc, however the chart above is out of date, as most AVs have updated or improved their resource usage since then, I know Avast/Bitdefender have. However still useful as a guide only.

there is not time to try them all so have to be guided somewhere (in addtion to OC) defender has been persistantly bad on performance too.

 

[Elevon]

good point -
Don't use it, but, I wonder how facebook has been resilient as a (software) malware distribution mechanism - curated attachments and gif rogue code inclusion mastered ?

EDIT : so facebook had been impacted , and, surprisingly, ms defender would not help unless you use unless you use edge/ie browsers




there is not time to try them all so have to be guided somewhere (in addtion to OC) defender has been persistantly bad on performance too.

I don't use Facebook period, as to Defender I'm not disagreeing with you , that is why I use a third party AV .

 

[Ev0]

I use Cylance Home edition, IMO easily the best AV product on the market today.

Does not need signature updates, like the majority of products, which means no one needs to be infected before a update can be released.

https://www.cylance.com/en_us/products/our-products/homeedition.html

Seem this a lot at trade shows, never had the chance to try it out but as you say seems to focus on anomaly detection type stuff rather than just signatures

Guessing it can pickup standard stuff that an AV would that really is easiest done via a signature as well though?

Spent a fair few years now telling people the benefits of not relying on signature based detection alone so always interested in stuff like this

Sadly not eligible for their home edition, but am able to tinker with a few similar types of product in development now and again.

 

[jpaul]

lol - no signature - Cylance is no different we already took it apart https://forums.overclockers.co.uk/posts/30793190

 

[Ev0]

Many have tried and failed to persuade people to junk their traditional signature based av for the next latest and greatest, which is often nothing new in its own right.

Heck ISS were doing host/network based anomaly detection yonks ago, you wouldn’t replace signature based av with it though, the technologies are complimentary.

Nothing wrong with signatures to detect a lot of stuff, for some things it’ll be the most efficient way of doing it.

Seems that a new product now needs the words machine learning or AI in there somewhere in the marketing blurb

 

[mysticsniper]

Had a quick scout... No mention of prices... I never like that... I like to know what I am heading for so I know whether to spend time looking at it, or indeed if I am simply wasting time as I have no intention of paying for it.

The price is £50 a year per licence, but you can add up to 10 devices to each licence.

 

[Ev0]

The price is £50 a year per licence, but you can add up to 10 devices to each licence.

Not horrendous, but you have to work for an enterprise customer to be eligible?

 

[mysticsniper]

Seem this a lot at trade shows, never had the chance to try it out but as you say seems to focus on anomaly detection type stuff rather than just signatures

Guessing it can pickup standard stuff that an AV would that really is easiest done via a signature as well though?

Spent a fair few years now telling people the benefits of not relying on signature based detection alone so always interested in stuff like this

Sadly not eligible for their home edition, but am able to tinker with a few similar types of product in development now and again.

I have thrown everything at Cylance in testing this product and I am really impressed, I downloaded the entire Zoo collection from Github and it detected and removed everything.

It even removed the malicious version of cc cleaner which was compromised.

The problem with signature based updates, is that they are only good for 15 minutes, when you have an zero day attack, unless you are using AI detection, no one will have an update, you need someone to be infected first.

 

[mysticsniper]

Not horrendous, but you have to work for an enterprise customer to be eligible?

I'm sure if you can afford it, they would sell it to you

 

[Ev0]

I have thrown everything at Cylance in testing this product and I am really impressed, I downloaded the entire Zoo collection from Github and it detected and removed everything.

It even removed the malicious version of cc cleaner which was compromised.

The problem with signature based updates, is that they are only good for 15 minutes, when you have an zero day attack, unless you are using AI detection, no one will have an update, you need someone to be infected first.

Oh I agree there, a signature is good for that point in time, but threats change, mutation for evasion is easy so rather than keep updating the sigs go for identifying the behaviour instead.

Just is funny reading all the blurb the vendors come out with, even when you’ve worked for them.

But you arguably still benefit from having the signature as well to catch that ‘easy’ stuff rather than waste resource on building models to detect etc.

It’s a brave CISO who has the strategy to ditch their ‘traditional’ AV totally in favour of these next gen type solutions.

Not saying they are right or wrong in that decision.

I'm sure if you can afford it, they would sell it to you

I’m sure they would, can go in my test environment with all my other toys

 

[C-Roy]

I'm on AVG business edition. Hoping this keeps me protected for the forceable.

 

[FatRakoon]

Yes, I use ESET and I am happy as a pig in stuff, but its for my lesser used other PCs... I cannot justofy buying loads of licences and so Im only interested in free options.

I dont care is Kaspersky is free... They have been done for being spyware and so Im never going to bother wasting my time with that. it is a non option.

AVAST own AVG? Didnt know that, although their interfaces do have similarities.

50 a year and you can have 10 PCs on the one licence, then that sounds actually a very cheap price to be honest....

I mean, right now, in my home, I have :-

My Server, Main AMD, Main Intel, My 3 kids all have a PC each, my bedroom and the Media Centre in the Living room are all Windows based PCs and thats 8.
This does not include my mess about systems and the LinuxPCs or the Macs or any of my Laptops.

I dont have any AV for the Linux or the Macs to be honest, although paranoia has made me consider it.... Maybe not paranoia, but certainly habit, plus the fact that I havbe seen A/Vs for them.

 

[FatRakoon]

All my W10 devices in the house (10+) are using Defender, nothing else. I use a hardware firewall and common sense and never had any infections.

Yes, I will admit that a good hardware firewall does make me feel far happier.

 

[jpaul]

Following last tv episode of Homeland where computer has ransomware delivered by a gif attachment - is this still an infection mechanism ?
, or are all image viewers now more patched, to avoid executing code that can be embedded (so just Hollywood license)
I could not find any info


Did see a new brand of Android malware/app

A new Android malware strain can phish Facebook user credentials and then log into accounts to harvest account details, and even search and collect results using the Facebook app's search functionality.
..
Fakeapp starts a WebView window (WebView is a stripped down mobile browser app) and makes this window almost entirely transparent with a window alpha-transparency value of "0.01f" — near 0.

It then loads the Facebook login page and accesses the user's account. While Symantec did not explain why this happens, we believe attackers are trying to avoid Facebook security measures that warn users when someone is trying to access an account from a new IP address. By logging in from the same phone, the attacker is using the victim's normal IP

They have been done for being spyware

yes - per earlier comments - tried and convicted by the US government

 

[Elevon]

Yes, I will admit that a good hardware firewall does make me feel far happier.

I think most of us here also use a good hardware firewall, but that does not mean I will skimp on my AV. As you know some AVs are better then others, having several different layers of good security with common sense and your important stuff backed up is the best way to go.

 

[FatRakoon]

yes - per earlier comments - tried and convicted by the US government

I see that. I have to be honest, but when I came to the post, it only showed me a page, but then after I replied, I saw it had gone to 3 pages.
I never read the others until AFTER I posted the link, but then as I read through it, I then remembered thqat Kaspersky did indeed get done etc... I simply forgot.
This is an annoying issue I now suffer from, after trying to headbut a recycling bin on my bike LOL ( True ), and I dont take my meds properly ( also true ).

I think most of us here also use a good hardware firewall, but that does not mean I will skimp on my AV. As you know some AVs are better then others, having several different layers of good security with common sense and your important stuff backed up is the best way to go.

Yes, I am quite OCD about backups. I have 4 NAS Boxes that contain 4x4GB + 4x4GB + 2x2GB + 2x2GB and also my Server has 4x10TB Drives ( RAID 10 ) and the Server is now stored in my Shed ( Its concrete and in the back garden so its secure enough, plus if the house burns down, my data is or should be safe. The Server is running through my KVM and even though its cabled through both a home made USB cable, and a home made single LAN cable, it works great. plus as one extra bit of clear OCD-ness that I have, I also have an 8TB drive that I keep at a mates house, and whenever he comes over for a brew, I backup my stuff to that too!

All utterly stupid if I am honest, and the vast majority of my stuff is ISO images of all my games so I can install from ISO and keep my Game Collection in pristine condition, and also I have almost 3TB of STEAM Games, plus, I have many of those games on both Mac and Linux ( Just cos I want to, no real reason ) and, that I am a vicioushoarder and I have NEVER deleted a single thing off my PC, including every single eMail that I have ever had, so its takes space that lets be honest, will NEVER be accessed again.

 

[jpaul]

Facebook same sanctions as Kaspersky ?

Did not think it was worthy of a thread,
but with all the concern about Mr Putin, we now find the USA election was partially managed courtesy of Facebook users (which demographiic - s'flake ?)
who downloaded free quiz apps with prizes, that harvested their data to be sent to the likes of Cambridge Analytica for voter targetting/profiling. ...
who need the Russians ?

https://nakedsecurity.sophos.com/20...me-accused-of-stealing-and-selling-user-data/